MD5 Hash Verification

Purpose: Generate a unique fingerprint of a file to identify it, check if it’s known malware, and verify integrity.

---

1. Quick Commands

Windows (Cmder / PowerShell)

# Using md5sum (Cmder / Git Bash / WSL)
md5sum.exe FileName.exe

# Using PowerShell native
Get-FileHash -Algorithm MD5 FileName.exe

# Using certutil
certutil -hashfile FileName.exe MD5

Linux / macOS

# Standard
md5sum FileName.exe

# macOS
md5 FileName.exe

# OpenSSL
openssl md5 FileName.exe

---

2. What is MD5?

• MD5 (Message-Digest Algorithm 5) produces a 128-bit (32 hex character) hash
• Designed by Ron Rivest in 1991
• Deterministic: Same input → same hash, always
• One-way: Cannot reverse a hash back to the original file
• Fast: Very quick to compute even on large files

Example Output

d41d8cd98f00b204e9800998ecf8427e  empty_file.txt
5d41402abc4b2a76b9719d911017c592  hello.txt
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6  malware_sample.exe

---

3. MD5 vs SHA-256 — When to Use Which

Feature	MD5	SHA-256
Hash length	128-bit (32 hex chars)	256-bit (64 hex chars)
Speed	Faster	Slower
Collision resistance	BROKEN (collisions found since 2004)	Strong (no known collisions)
Use in malware analysis	Still widely used for quick lookups	Preferred for authoritative identification
VirusTotal	Accepted	Accepted (primary)
NIST recommendation	Deprecated for security	Recommended

Bottom Line

• MD5: Still widely supported in older tools/scripts, smaller/faster to store/type, sufficient for non-adversarial contexts (quick malware lookup)
• SHA-256: The authoritative, collision-resistant identifier — use this when you need certainty
• Best practice: Generate BOTH for every sample you analyze

---

4. Using Hashes for Malware Analysis

Step 1: Generate the Hash

md5sum suspicious_file.exe
# Output: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6  suspicious_file.exe

Step 2: Look Up on VirusTotal

1. Go to https://www.virustotal.com
2. Click Search tab
3. Paste the MD5 hash
4. Review detection results from 70+ AV engines

Step 3: Search Threat Intelligence Databases

Platform	URL	What It Provides
VirusTotal	virustotal.com	AV detections, behavioral reports, community comments
MalwareBazaar	bazaar.abuse.ch	Malware sample database, family tags
Hybrid Analysis	hybrid-analysis.com	Sandbox reports with full behavioral data
ANY.RUN	any.run	Interactive sandbox reports
AlienVault OTX	otx.alienvault.com	Threat intelligence pulses
Malshare	malshare.com	Free malware sample repository
Joe Sandbox	joesandbox.com	Detailed sandbox analysis
InQuest Labs	labs.inquest.net	Deep file inspection

Step 4: Check if Previously Analyzed

# Search multiple databases at once using curl
curl -s "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_info" \
  -d "hash=a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"

---

5. Bulk Hashing

Hash All Files in a Directory

# Linux
find . -type f -exec md5sum {} \; > hashes.txt

# Hash only executables
find . -name "*.exe" -exec md5sum {} \; > exe_hashes.txt

# Generate both MD5 and SHA256
for f in *.exe; do
    echo "=== $f ==="
    md5sum "$f"
    sha256sum "$f"
done

PowerShell Bulk Hashing

Get-ChildItem -Path . -Filter *.exe | ForEach-Object {
    $md5 = (Get-FileHash $_.FullName -Algorithm MD5).Hash
    $sha256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    Write-Output "$($_.Name): MD5=$md5 SHA256=$sha256"
}

---

6. OSINT Pivoting with Hashes

Once you have a hash, you can pivot to find related malware:

Hash → VirusTotal → "Relations" tab → 
  → Contacted domains/IPs
  → Dropped files (hashes of children)
  → Parent files (who dropped this)
  → Similar samples (same family)
  → Bundled files

Hash-Based YARA Rule

rule known_malware_sample {
    condition:
        hash.md5(0, filesize) == "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" or
        hash.sha256(0, filesize) == "e3b0c44298fc1c149afbf4c8996fb924..."
}

---

7. MD5 Collision Warning

Important: MD5 is cryptographically broken. Two different files CAN produce the same MD5 hash (collision attacks). This means:

• An attacker could craft a malicious file with the same MD5 as a legitimate one
• Never rely on MD5 alone for file verification in security contexts
• Always use SHA-256 as primary identifier, MD5 as secondary for quick lookups

Famous MD5 Collision Examples

• 2004: Wang et al. demonstrated first MD5 collisions
• 2012: Flame malware used MD5 collision to forge a Microsoft certificate
• 2017: SHAttered project showed practical SHA-1 collisions (MD5 was already broken)